A method and device for identifying semi-connection scanning of a host process

Abstract

The application provides a recognition method and device for a host process to perform a half-connection scanning outside, the method comprising: obtaining half-connection access data of the host process outside; performing white list filtering on the access data; grouping the current access data, splicing the access target IP and the access target port for each piece of data in each group to obtain spliced IP:PORT data; determining a total risk score of the host process outside scanning based on the IP:PORT data; and determining whether the host process appears the phenomenon of performing the half-connection scanning outside based on the total risk score and a threshold value configured for the total risk score, so that the phenomenon of performing the half-connection network scanning outside can be accurately recognized through efficient half-connection network connection data collection and risk recognition calculation after grouping and aggregation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of servers, and in particular to a method and device for identifying semi-connection scanning of a host process. BACKGROUND

[0002] Semi-connection network scanning, such as Masscan, is a main scanning method in attacks such as horizontal penetration, and semi-connection scanning has high concealment, does not generate TCP complete session records, and has extremely high scanning performance, and is therefore widely used, but current related detection technologies have many deficiencies.

[0003] Traditional network scanning detection is mainly achieved by deploying bypass traffic detection probes in the network boundary to detect network scanning, and this scheme mainly covers south-north traffic, and the cost of covering east-west traffic is too high, and it is difficult to cover the servers in the machine room. In addition, the detection on the network traffic side cannot accurately identify the attack process information, and there are many problems in security analysis and positioning, automatic false alarm elimination, and the like.

[0004] However, the traditional scheme on the host side is limited to collecting netstat network snapshots, and can only detect full-connection network scanning on the host, and in fact, if semi-connection network scanning is initiated to the outside or there are few intranet servers, it is impossible to generate too many connection records, and it is impossible to complete the related detection.

[0005] Therefore, how to identify that a process on a server is performing semi-connection scanning to the outside, there is no good solution at present. SUMMARY

[0006] The technical problem to be solved by the present application is how to identify that a process on a server is performing semi-connection scanning to the outside. In view of this, the present application provides a method and device for identifying semi-connection scanning of a host process to the outside.

[0007] The technical solution adopted by the present application is a method for identifying semi-connection scanning of a host process to the outside, comprising:

[0008] Obtaining semi-connection access data of the host process to the outside;

[0009] Filtering the access data by a white list;

[0010] Grouping the current access data, and splicing the access target IP and the access target port for each piece of data in each group to obtain spliced IP:PORT data;

[0011] Determining a total score of the risk of scanning to the outside of the host process based on the IP:PORT data;

[0012] Based on the total risk score, a configured threshold is used to determine whether the host process exhibits a half-connection scanning phenomenon to the outside.

[0013] In one embodiment, the obtaining of the half-connection access data of the host process comprises:

[0014] The half-connection access data of the process is captured through eBPF XDP; and / or

[0015] The half-connection access data is collected by kernel Hook.

[0016] In one embodiment, the grouping of the current access data, for each piece of data in each group, splicing the access target IP and the access target port to obtain the spliced IP:PORT data comprises:

[0017] Data with the same host UUID and the same process ID in the access data is grouped into the same group;

[0018] The access target IP and the access target port in each piece of data in each group are spliced to obtain the spliced IP:PORT data.

[0019] In one embodiment, the determining of the total risk score of the host process for the external scanning based on the IP:PORT data comprises:

[0020] The IP:PORT data is de-duplicated to determine the total de-duplication number N;

[0021] The N is subjected to weight calculation processing to determine the total risk score of the host process for the external scanning.

[0022] Another aspect of the application also provides a device for identifying a host process for half-connection scanning to the outside, comprising:

[0023] An obtaining module configured to obtain half-connection access data of a host process;

[0024] A filtering module configured to perform white list filtering on the access data;

[0025] A data processing module configured to group current access data, for each piece of data in each group, splice the access target IP and the access target port to obtain the spliced IP:PORT data;

[0026] An evaluation module configured to determine a total risk score of a host process for external scanning based on the IP:PORT data;

[0027] A determination module is configured to determine, based on the total risk score, whether the host process corresponding to the total risk score exhibits a phenomenon of performing a semi-connection scan to the outside using a configured threshold value.

[0028] In an embodiment, the acquisition module is further configured to:

[0029] capture the semi-connection access data to the outside by eBPF XDP;

[0030] acquire the semi-connection access data to the outside by kernel Hook.

[0031] In an embodiment, the data processing module is further configured to:

[0032] group data with the same host UUID and the same process ID in the access data into the same group;

[0033] splice the access target IP and the access target port in each piece of data in each group to obtain spliced IP:PORT data.

[0034] In an embodiment, the evaluation module is further configured to:

[0035] de-duplicate the IP:PORT data to determine a total de-duplication number N;

[0036] perform weight calculation processing on N to determine a total risk score of the host process scanning to the outside.

[0037] Another aspect of the present application also provides an electronic device, which comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program implements the steps of the identification method for the host process scanning to the outside by semi-connection as described in any one of the above embodiments when executed by the processor.

[0038] Another aspect of the present application also provides a computer storage medium, which stores a computer program, and the computer program implements the steps of the identification method for the host process scanning to the outside by semi-connection as described in any one of the above embodiments when executed by a processor.

[0039] By using the above technical solution, the present application has at least the following advantages:

[0040] The application connects data collection through an efficient semi-connection network, effectively reduces false positives through a white list, and improves detection performance. After risk identification calculation after grouping aggregation, it can accurately identify which process on which host is performing a semi-connection network scan. The problems of the traditional network side being difficult to cover east-west scanning and being unable to accurately identify the scanning process are solved. The problem of the traditional host security being unable to cover the semi-connection network scan anomaly detection of the host process to the outside is also solved. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 A flowchart of a method for identifying a host process to perform a semi-connection scan to the outside according to an embodiment of the application;

[0042] Figure 2 A specific implementation framework diagram of a method for identifying a host process to perform a semi-connection scan to the outside according to an embodiment of the application;

[0043] Figure 3 A component structure diagram of an identification device for a host process to perform a semi-connection scan to the outside according to an embodiment of the application;

[0044] Figure 4 A structure diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0045] In order to further illustrate the technical means and effects taken by the present application to achieve the predetermined purposes, the present application will be described in detail below in combination with the drawings and preferred embodiments.

[0046] In the drawings, the thickness, size and shape of the objects have been slightly exaggerated for the sake of illustration. The drawings are merely exemplary and are not strictly drawn to scale.

[0047] It should also be understood that the words "comprise", "comprising", "have", "having", "include", "including", "contain", "containing", "provide", "provided", "provide for", "provided for", "defined in", "define", "defined", "define for", "defined for", "may" and / or "including", when used in this specification, indicate the presence of the stated features, integers, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. In addition, when expressions such as "at least one of" appear after a list of one or more items, it indicates that any one of the listed items can be present, or combinations of one or more of the listed items can be present. In addition, when describing embodiments of the present application, the use of "may" indicates "one or more embodiments of the present application". Furthermore, the word "exemplary" is intended to mean example or illustrative.

[0048] As used herein, the terms "substantially," "approximately," and similar terms, used in reference to quantities, are used in their normal, ordinary sense to refer to a quantity that can vary from a true value by a margin of error. Such terms should therefore be construed as using the term in its ordinary sense, rather than in an absolute sense, unless expressly so defined herein.

[0049] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an overly literal or overly formal sense unless expressly so defined herein.

[0050] It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict, if not otherwise stated. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0051] In a first embodiment of the present application, a method for identifying a host process for performing a semi-connection scan outside, as shown in Figure 1 , includes the following steps:

[0052] Step S1, obtaining semi-connection access data of the host process outside;

[0053] Step S2, performing white list filtering on the access data;

[0054] Step S3, grouping the current access data, and for each piece of data in each group, splicing the access target IP and the access target port to obtain the spliced IP:PORT data;

[0055] Step S4, determining a total risk score of the host process for performing a semi-connection scan outside based on the IP:PORT data;

[0056] Step S5, determining whether the host process appears to perform a semi-connection scan outside based on the total risk score and a configured threshold value corresponding to the total risk score.

[0057] Referring to Figure 2 , the method provided by the embodiment will be described in detail in the following steps.

[0058] Step S1, obtaining semi-connection access data of the host process outside;

[0059] In the embodiment, obtaining semi-connection access data of the host process outside can further include: capturing the semi-connection access data of the process outside through eBPFXDP; and / or collecting the semi-connection access data by using kernel Hook.

[0060] Specifically, the Linux eBPF technology hooks the kernel function inet_sock_set_state to efficiently collect the half-connection network request data initiated by the host process, and optionally, other ways such as system kernel hooking are supported to collect the half-connection network request data initiated by the host process. The present embodiment is not limited in this regard.

[0061] A probe (hereinafter referred to as Agent) is deployed on the host to collect half-connection network data. The Agent is divided into a kernel-mode Agent and a user-mode Agent. The kernel-mode Agent is implemented using the Linux eBPF technology and is attached to the host kernel to monitor the kernel function inet_sock_set_state (which is called when the network connection state changes, and the function parameters include old_state and new_state) in real time. When the function is called, the half-connection data collection logic is executed, and the collection logic is described as follows:

[0062] 1) Only the connection state changes of CLOSED->SYN_SENT and SYN_SENT->ESTABLISHED are concerned. CLOSED->SYN_SENT indicates that the connection is changed from closed to half-connection state, and SYN_SENT->ESTABLISHED indicates that the connection is changed from half-connection to full-connection state.

[0063] 2) When the process initiates a network connection, the network connection state is changed from CLOSED->SYN_SENT, i.e., to half-connection state. The network connection information is collected, including process PID, process name, process path, process command line argument, process UID, process EUID, process GID, parent process PID, parent process name, parent process path, parent process UID, parent process EUID, parent process GID, source IP, source port, target IP, target port, and protocol type. The collected network connection information is stored in ebpfmap A with the network five-tuple: source IP+source port+target IP+target port+protocol type as the key, and the network five-tuple: source IP+source port+target IP+target port+protocol type is stored in ebpfmap B.

[0064] 3) When the network connection state is changed from SYN_SENT->ESTABLISHED, it indicates that the connection has been established. The network connection data stored in ebpfmap A with the network five-tuple: source IP+source port+target IP+target port+protocol type as the key is deleted, and the full-connection network connection data is removed, leaving only the half-connection network connection data.

[0065] 4) User state Agent real-time network quintuple information from ebpfmap B, and every minute, using network quintuple as key, from ebpfmap A to obtain half-connection network connection information, if obtained, half-connection network connection information is stored in cache, and the data recorded in ebpfmap A is deleted. Traverse the cache to process PID + process name + target IP + target port as key, perform data aggregation, and report the data to Flink, Spark, and other data analysis platforms.

[0066] It can be understood that, compared with the current mainstream scheme of monitoring the connect system call (LinuxKaudit) or periodically obtaining network connection data in the SYN_SENT / ESTABLISHED state on the system, the scheme can accurately obtain network connection data in the half-connection state, excluding full-connection data, has good support for short-time connection, low false alarm rate, low system invasiveness, and low system resource consumption.

[0067] Step S2, performing white list filtering on the access data;

[0068] In the embodiment, the network connection data including half-connection collected in real time on the host side can be consumed and calculated by Flink, Spark, and other data analysis platforms. First, white list matching calculation is performed to reduce false alarms and improve overall calculation performance. The white list supports user-defined configuration or automatic issuance according to alarms. The patent scheme supports white list filtering from the fields of IP, network segment, IP type (intranet, Internet), IP geographic location, port, process name, process MD5, process path, etc. The data matched with the white list is directly ignored and does not perform subsequent detection logic.

[0069] Step S3, grouping the current access data, and splicing the access target IP and the access target port in each piece of data in each group to obtain the spliced IP:PORT data;

[0070] In the embodiment, the current access data is grouped, and the access target IP and the access target port in each piece of data in each group are spliced to obtain the spliced IP:PORT data, which further comprises: grouping the data with the same host UUID and the same process ID in the access data into the same group; and splicing the access target IP and the access target port in each piece of data in each group to obtain the spliced IP:PORT data.

[0071] That is, into the packet aggregation logic, can be grouped according to the host UUID, process ID, optionally, the embodiment can support selecting process path, parent process path, process name, parent process name, etc. for grouping, network connection data of the same host UUID, the same process ID into a group, and then, for each data in the group, the access target IP and the access target port are spliced to output the spliced IP:PORT data.

[0072] Step S4, determining the total score of the host process external scanning risk based on the IP:PORT data;

[0073] In the embodiment, based on the IP:PORT data, the total score of the host process external scanning risk is determined, further comprising: de-duplicating the IP:PORT data to determine the total number of de-duplication N; and performing weight calculation processing on N to determine the total score of the host process external scanning risk.

[0074] In some embodiments, the IP:PORT data spliced in the group can be de-duplicated and counted, and the total number of de-duplication N can be calculated. Optionally, all de-duplicated IP:PORT in the group can be merged and spliced to calculate the information entropy or other features. Then, all features are calculated according to the weight to determine the total score of the host process external scanning risk.

[0075] Step S5, based on the total score, using the configured threshold to determine whether the host process corresponding to the total score appears to perform external half-connection scanning.

[0076] For example, if the total score is greater than or equal to the threshold value (default 300), it is considered that the process is performing external network scanning including half-connection network scanning, and if it is less than the threshold value, it is considered that the process is performing external network scanning. The threshold value can be adjusted according to the running situation, or after running the model for a certain period of gray learning, the threshold value is configured.

[0077] In the embodiment, if the host side process recognizes external half-connection or other network scanning, an alarm will be generated, and optionally, automatic interception and automatic termination of abnormal processes can be enabled. For the alarm, if it is selected to be ignored, a white list policy can be automatically generated into the white list engine, and the automatically generated policy also supports selecting IP, network segment, IP type (internal network, Internet), IP geographic location, port, process name, process MD5, process path, etc. for combination.

[0078] Compared with the prior art, the embodiment has at least the following advantages:

[0079] 1) The embodiment collects host process external half-connection network connection data by eBPF hook kernel inet_sock_set_state function;

[0080] 2) This embodiment effectively reduces false positives and improves detection performance through white list;

[0081] 3) This embodiment can accurately identify which process on which host is performing a half-connection network scan by calculating the risk after grouping.

[0082] In summary, the embodiment can be used to alleviate the problems of traditional network side being difficult to cover east-west scanning and being unable to accurately identify scanning processes, and can also improve the problem of traditional host security being unable to cover the abnormal detection of host process half-connection network scanning.

[0083] The second embodiment of the present application corresponds to the first embodiment, and the embodiment introduces a recognition device for host process half-connection scanning, as shown in Figure 3 The recognition device includes the following components:

[0084] The acquisition module is configured to acquire the external half-connection access data of the host process;

[0085] The filtering module is configured to filter the access data by white list;

[0086] The data processing module is configured to group the current access data, and for each data in each group, splice the access target IP and the access target port to obtain the spliced IP:PORT data;

[0087] The evaluation module is configured to determine the total risk score of the host process external scanning based on the IP:PORT data;

[0088] The determination module is configured to determine whether the host process corresponding to the total risk score appears the phenomenon of external half-connection scanning by using the configured threshold based on the total risk score.

[0089] In one embodiment, the acquisition module is further configured to:

[0090] Capture the external half-connection access data of the process by eBPF XDP; and / or

[0091] Collect the external half-connection access data by kernel Hook.

[0092] In one embodiment, the data processing module is further configured to:

[0093] Group the data with the same host UUID and the same process ID in the access data into the same group;

[0094] The access target IP and the access target port in each piece of data in each group are spliced to obtain spliced IP:PORT data.

[0095] In one embodiment, the evaluation module is further configured to:

[0096] The IP:PORT data is deduplicated to determine a total deduplication number N;

[0097] The N is subjected to weight calculation processing to determine a total score of the host process external scanning risk.

[0098] The third embodiment of the present application is an electronic device, as shown in the figure, which can be understood as a physical device, comprising a processor and a memory storing processor-executable instructions, when the instructions are executed by the processor, the following operations are performed: Figure 4

[0099] Step S1, obtaining the external semi-connection access data of the host process;

[0100] Step S2, performing whitelist filtering on the access data;

[0101] Step S3, grouping the current access data, and for each piece of data in each group, splicing the access target IP and the access target port to obtain spliced IP:PORT data;

[0102] Step S4, determining a total score of the host process external scanning risk based on the IP:PORT data;

[0103] Step S5, based on the total risk score, using the configured threshold to determine whether the host process corresponding to the total risk score appears the external semi-connection scanning phenomenon.

[0104] The fourth embodiment of the present application, the flow of the method for identifying the host process external semi-connection scanning of the present embodiment is the same as that of the first, second or third embodiment, the difference lies in that in engineering implementation, the present embodiment can be realized by means of software plus necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better implementation. Based on such understanding, the method of the present application can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, magnetic disc, optical disc), and includes a plurality of instructions for causing a device to execute the method described in the embodiments of the present application.

[0105] Through the description of the specific embodiments, the technical means and effects taken by the present application to achieve the predetermined purpose can be understood more deeply and specifically, however, the accompanying drawings are only provided for reference and illustration, and are not used to limit the present application.​

Claims

1. A method for identifying a semi-connection scan by a host process to the outside, characterized by, The method comprises the following steps: obtaining external half-connection access data of a host process; whitelist filtering the access data; grouping the current access data, and splicing the access target IP and the access target port to obtain spliced IP:PORT data for each piece of data in each group; determining a total risk score of the external scanning of the host process based on the IP:PORT data; determining whether the host process appears to perform external half-connection scanning based on the total risk score and a configured threshold value; the method for obtaining the external half-connection access data of the host process comprises the following steps: deploying a probe Agent on the host, wherein the Agent is divided into a kernel mode Agent and a user mode Agent, the kernel mode Agent is attached to the host kernel, and the kernel function inet_sock_set_state is monitored in real time, the function parameters include old_state and new_state, and the half-connection data collection logic is executed when the function is called; the collection logic comprises the following steps: only focusing on the connection state changes of CLOSED->SYN_SENT and SYN_SENT->ESTABLISHED, wherein CLOSED->SYN_SENT represents that the connection state changes from closed to half-connection state, and SYN_SENT->ESTABLISHED represents that the connection state changes from half-connection to full-connection state; when the process initiates a network connection, the network connection state changes from CLOSED to SYN_SENT, that is, the network connection state changes to half-connection state, and the information of the network connection is collected, including the process PID, the process name, the process path, the process command line parameter, the process UID, the process EUID, the process GID, the parent process PID, the parent process name, the parent process path, the parent process UID, the parent process EUID, the parent process GID, the source IP, the source port, the target IP, the target port, and the protocol type, and the collected network connection information is stored in ebpfmap A as network quintuple: source IP+source port+target IP+target port+protocol type, and the network quintuple: source IP+source port+target IP+target port+protocol type is stored in ebpfmap B; when the network connection state changes from SYN_SENT to ESTABLISHED, that is, the connection is established, the network connection data stored in ebpfmap A is deleted as the network quintuple: source IP+source port+target IP+target port+protocol type, the full-connection network connection data is removed, and only the half-connection network connection data is reserved; the user mode Agent obtains the network quintuple information from ebpfmap B in real time, and every minute, the half-connection network connection information is obtained from ebpfmap A as the network quintuple, if the half-connection network connection information is obtained, the half-connection network connection information is stored in the cache, and the data recorded in ebpfmap A is deleted; the cache is traversed, the data is aggregated as the process PID+process name+target IP+target port, and the data is reported to a data analysis platform.

2. The identification method for a host process to perform a semi-connection scan externally according to claim 1, characterized in that, The access data of the external half-connection of the host process is obtained, including: The access data of the external half-connection of the process is captured through eBPF XDP; and / or The access data of the external half-connection is collected by using kernel Hook.

3. The method of claim 1, wherein the method further comprises: The current access data is grouped, and for each piece of data in each group, the access target IP and the access target port are spliced to obtain spliced IP:PORT data, including: Data with the same host UUID and the same process ID in the access data is divided into the same group; The access target IP and the access target port in each piece of data in each group are spliced to obtain spliced IP:PORT data.

4. The method of claim 1, wherein, Based on the IP:PORT data, the total score of the risk of external scanning of the host process is determined, including: The IP:PORT data is de-duplicated to determine the total number of de-duplication N; The total score of the risk of external scanning of the host process is determined by performing weight calculation processing on N.

5. An identification device for a host process to externally perform a semi-connection scan, characterized by, It includes: An acquisition module configured to obtain access data of an external half-connection of a host process; A filtering module configured to perform whitelist filtering on the access data; A data processing module configured to group current access data, and for each piece of data in each group, splice an access target IP and an access target port to obtain spliced IP:PORT data; An evaluation module configured to determine a total score of the risk of external scanning of a host process based on the IP:PORT data; A determination module configured to determine whether the host process appears to perform a half-connection scanning phenomenon based on the total score of the risk and a configured threshold value corresponding to the total score of the risk; The acquisition module is specifically configured to: Deploy a probe Agent on the host, and the Agent is divided into a kernel mode Agent and a user mode Agent, the kernel mode Agent is attached to the host kernel, and the kernel function inet_sock_set_state is monitored in real time, the function parameters include old_state and new_state, and the half-connection data collection logic is executed when the function is called; The collection logic includes: Only the connection change state of CLOSED->SYN_SENT and SYN_SENT->ESTABLISHED is concerned, CLOSED->SYN_SENT indicates that the connection is changed from a closed state to a half-connection state, and SYN_SENT->ESTABLISHED indicates that the half-connection is changed to a full-connection state; When the process initiates a network connection, the network connection state changes from CLOSED->SYN_SENT, i.e. to a half-connection state, and the information of the network connection is collected: process PID, process name, process path, process command line argument, process UID, process EUID, process GID, parent process PID, parent process name, parent process path, parent process UID, parent process EUID, parent process GID, source IP, source port, target IP, target port, protocol type, and the collected network connection information is stored in ebpfmap A with the network five-tuple: source IP+source port+target IP+target port+protocol type as the key, and the network five-tuple: source IP+source port+target IP+target port+protocol type is stored in ebpfmap B; When the network connection state changes from SYN_SENT->ESTABLISHED, it indicates that the connection has been established, and the network connection data stored in ebpfmap A is deleted with the network five-tuple: source IP+source port+target IP+target port+protocol type as the key, and only the half-connection network connection data is retained; The user state Agent acquires the network five-tuple information from ebpfmap B in real time, and every minute, acquires the half-connection network connection information from ebpfmap A using the network five-tuple as the key, and if the half-connection network connection information is acquired, stores the half-connection network connection information in the cache and deletes the recorded data in ebpfmap A; traverses the cache to aggregate data with process PID+process name+target IP+target port as the key, and reports the data to a data analysis platform.

6. The apparatus of claim 5, wherein, The acquisition module is further configured to: capture the process's external half-connection access data through eBPF XDP; and / or collect the external half-connection access data by using kernel Hook.

7. The apparatus of claim 5, wherein, The data processing module is further configured to: divide the data of the same host UUID and the same process ID in the access data into the same group; splice the access target IP and the access target port in each piece of data in each group to obtain spliced IP:PORT data.

8. The apparatus of claim 5, wherein, The evaluation module is further configured to: de-duplicate the IP:PORT data to determine the total de-duplication number N; perform weight calculation processing on N to determine the total score of the host process's external scanning risk.

9. An electronic device, comprising: The electronic device includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program, when executed by the processor, implements the steps of the identification method for host process external half-connection scanning according to any one of claims 1 to 4.

10. A computer storage medium having a computer program stored thereon, the computer program, when executed by a processor, implements the steps of the identification method for host process external half-connection scanning according to any one of claims 1 to 4.

Images